# Osquery, Yara and Sigfile

**URL:** <https://discuss.elastic.co/t/osquery-yara-and-sigfile/371816>\
**Category:** Elastic Agent\
**Created:** [December 11, 2024, 9:13am UTC](https://discuss.elastic.co/t/osquery-yara-and-sigfile/371816 "2024-12-11T09:13:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DiscussArb](https://avatars.discourse-cdn.com/v4/letter/d/ea5d25/32.png) [@DiscussArb](https://discuss.elastic.co/u/DiscussArb)\
**Post date:** [December 11, 2024, 9:13am UTC](https://discuss.elastic.co/t/osquery-yara-and-sigfile/371816/1 "2024-12-11T09:13:15Z")

</div>

I have a bunch of Yara rules that I would like to run on demand using the Yara table in Osquery. Is it possible to use the sigfile parameter, and if so, where should the file be stored so that Osquery finds the sigfile when running the query? Also, how should the sigfile be formatted?

Regards,  
Arb

---

<div class="post-metadata">

**Author:** ![DiscussArb](https://avatars.discourse-cdn.com/v4/letter/d/ea5d25/32.png) [@DiscussArb](https://discuss.elastic.co/u/DiscussArb)\
**Post date:** [March 13, 2025, 2:39pm UTC](https://discuss.elastic.co/t/osquery-yara-and-sigfile/371816/2 "2025-03-13T14:39:45Z")

</div>

So, just found out that the sigfile needs to be stored on the endpoint where Osquery is running. Formatted just like any other yar file out there.